agentmods.dev

bunkervm: Instructions file for GitHub Copilot

.github/copilot-instructions.md

bunkervm copilot-instructions.md is an instructions file for GitHub Copilot from ashishgituser/bunkervm. It costs 2,299 tokens per session, scanned B, original, MIT.

Project instructions for BunkerVM, a Python library that starts disposable Firecracker microVMs for agents to run untrusted code in hardware-isolated environments. They describe its architecture, conventions, and framework-integration work.

In plain words
What is it for?
Implementing and reviewing BunkerVM changes, including VM lifecycle, isolated code execution, communication between host and guest, and new framework integrations.
Why use it?
They give a coding agent the repository context needed to change the host-side VM manager, guest-side execution service, MCP server, or integrations consistently.

Instructions file for GitHub Copilot

Written for GitHub Copilot: a Copilot instructions file.

This is ashishgituser/bunkervm's own configuration. It tells GitHub Copilot how to work on bunkervm itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything bunkervm configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is python tests/smoke_test.py.

not rated 1repo 2mo ago B scan 2,299 tokens original MIT
View source ↗ ashishgituser/bunkervm ashishgituser.github.io
Reuse

Borrowing it

Nothing to install: this file belongs to ashishgituser/bunkervm. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ashishgituser/bunkervm/main/.github/copilot-instructions.md
Clone the repo
git clone --depth 1 https://github.com/ashishgituser/bunkervm

Made for: GitHub Copilot.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bunkervm copilot-instructions.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/ashishgituser/bunkervm/copilot-instructions/github.svg)](https://agentmods.dev/instructions/ashishgituser/bunkervm/copilot-instructions)
Your own site
<a href="https://agentmods.dev/instructions/ashishgituser/bunkervm/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/ashishgituser/bunkervm/copilot-instructions/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for bunkervm copilot-instructions.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/ashishgituser/bunkervm/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/ashishgituser/bunkervm/copilot-instructions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 2,299 This file is loaded in full into every session.
When invoked 2,299 The same file — it is already loaded in full.
Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.02299 $0.02299
Opus 5.5 $0.00920 $0.00920
Sonnet 5.5 $0.00460 $0.00460
Haiku 4.5 $0.00230 $0.00230

Measured 1mo ago against content hash e1ad73ae6b1c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

bunkervm copilot-instructions.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- **vsock** (default): Host ↔ VM via Firecracker UDS. Zero network config, no sudo needed.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

- **`tools.py`** — Single `execute(cmd)` function using `subprocess.run()`. The entire OS is the tool — no hardcoded tool list.
.github/copilot-instructions.md · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

BunkerVM — Copilot Instructions

Project Overview

BunkerVM is a Python library (pip install bunkervm) that boots disposable Firecracker microVMs for AI agents to execute untrusted code with hardware-level (KVM) isolation. The core loop: boot VM (~3s) → execute code → destroy VM. Only dependency is mcp.

Architecture

Host side (bunkervm/)                    Guest side (rootfs/bunkervm/)
─────────────────────                    ────────────────────────────
cli.py / __main__.py  →  vm_manager.py  →  [Firecracker process]
                              ↕ vsock                ↕
                       sandbox_client.py  ←→  exec_agent.py (HTTP over vsock)
                              ↑
              mcp_server.py / integrations/
  • vm_manager.py — Firecracker process lifecycle (start/stop/restart), TAP networking setup, rootfs copies. Communicates via vsock UDS (/tmp/bunkervm-vsock.sock).
  • sandbox_client.py — Stdlib-only HTTP client that speaks the Firecracker vsock handshake protocol (CONNECT <port>\n → OK <port>\n → HTTP). No external HTTP libs.
  • rootfs/bunkervm/exec_agent.py — Runs inside the VM. Zero-dependency HTTP server (stdlib only, must work on Alpine/musl). Endpoints: /exec, /read-file, /write-file, /list-dir, /health, /status.
  • mcp_server.py — Exposes sandbox operations as MCP tools via FastMCP. Global state set by __main__.py before server starts.
  • integrations/base.py — BunkerVMToolsBase provides 6 shared tool implementations (_run_command, _write_file, _read_file, _list_directory, _upload_file, _download_file). Framework adapters (langchain.py, openai_agents.py, crewai.py) wrap these with framework-specific decorators — never duplicate tool logic in adapters.
  • safety.py — Regex-based command classifier (READ/WRITE/SYSTEM/DESTRUCTIVE/BLOCKED). Defense-in-depth only; the VM is the real isolation boundary.
  • bootstrap.py — Auto-downloads Firecracker bundle to ~/.bunkervm/bundle/ on first run. Falls back to build/ dir in dev mode.
  • config.py — Layered config: CLI args > env vars (BUNKERVM_*) > bunkervm.toml > built-in defaults.

Read the full file on GitHub · 142 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 142 lines · 2,299 tokens per session scan B e1ad73ae6b1c

Subscribe to this mod's changes

bunkervm copilot-instructions.md is an instructions file published in the GitHub repository ashishgituser/bunkervm (1 stars, last pushed 2mo ago), licensed MIT. It adds 2,299 tokens to every session, about $0.0092 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Securityagent-sandboxai-agentsfirecrackerisolationkvmllm-agents
Related

Other instructions, from other repositories

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 9,715 tokens

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,461 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).

microsoft/vscode · 5,262 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,680 tokens

vscode copilot-instructions.md

Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).

microsoft/vscode · 2,731 tokens

vscode model-prompts.instructions.md

Model-specific prompt authoring and registry guidelines.

microsoft/vscode · 2,022 tokens